# CVEs published 2023-03-08

55 CVEs were published on March 8, 2023: 16 critical, 17 high. Days are UTC.

- [CVE-2022-37939](https://cve.now/CVE-2022-37939.md): A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers. (CVSS 2.3, Hewlett Packard Enterprise (HPE) HPE Superdome Flex Servers…)
- [CVE-2023-26489](https://cve.now/CVE-2023-26489.md): Guest-controlled out-of-bounds read/write on x86\_64 in wasmtime (CVSS 10.0, bytecodealliance wasmtime · wasmtime +1)
- [CVE-2023-24532](https://cve.now/CVE-2023-24532.md): Incorrect calculation on P256 curves in crypto/internal/nistec (no CVSS, Go standard library crypto/internal/nistec · stdlib)
- [CVE-2023-24533](https://cve.now/CVE-2023-24533.md): Incorrect multiplication of unreduced P-256 scalars in filippo.io/nistec (CVSS 7.5, filippo.io/nistec)
- [CVE-2023-27486](https://cve.now/CVE-2023-27486.md): Insufficient authorization validation between zones when xCAT zones are enabled (CVSS 8.1, xcat2 xcat-core)
- [CVE-2023-23760](https://cve.now/CVE-2023-23760.md): Path traversal in GitHub Enterprise Server leading to remote code execution (CVSS 4.9, GitHub Enterprise Server)
- [CVE-2023-1278](https://cve.now/CVE-2023-1278.md): IBOS index.php cross site scripting (CVSS 3.5, IBOS)
- [CVE-2023-1277](https://cve.now/CVE-2023-1277.md): kylin-system-updater Update InstallSnap command injection (CVSS 7.8, kylin-system-updater)
- [CVE-2023-1276](https://cve.now/CVE-2023-1276.md): SUL1SS\_shop Order.php sql injection (CVSS 4.7, SUL1SS\_shop)
- [CVE-2023-1275](https://cve.now/CVE-2023-1275.md): SourceCodester Phone Shop Sales Managements System CAPTCHA index.php cross site scripting (CVSS 3.5, SourceCodester Phone Shop Sales Managements System)
- [CVE-2023-27905](https://cve.now/CVE-2023-27905.md): Jenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resultin (CVSS 9.6, Jenkins Project Jenkins update-center2 · org.jenkins-ci:upd…)
- [CVE-2023-27904](https://cve.now/CVE-2023-27904.md): Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, pot (CVSS 5.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2023-27903](https://cve.now/CVE-2023-27903.md): Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions (CVSS 4.4, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2023-27902](https://cve.now/CVE-2023-27902.md): Jenkins 2.393 and earlier, LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows attackers with Item/W (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2023-27901](https://cve.now/CVE-2023-27901.md): Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of re (CVSS 7.5, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2023-27900](https://cve.now/CVE-2023-27900.md): Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of re (CVSS 7.5, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2023-27899](https://cve.now/CVE-2023-27899.md): Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions (CVSS 7.0, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2023-27898](https://cve.now/CVE-2023-27898.md): Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depe (CVSS 9.6, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2022-46752](https://cve.now/CVE-2022-46752.md): Dell BIOS contains an Improper Authorization vulnerability. (CVSS 4.6, Dell CPG BIOS)
- [CVE-2022-20929](https://cve.now/CVE-2022-20929.md): A vulnerability in the upgrade signature verification of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated (CVSS 7.8, Cisco Enterprise NFV Infrastructure Software)
- [CVE-2023-1267](https://cve.now/CVE-2023-1267.md): SQLi in Ulkem Company's PtteM Kart (CVSS 9.8, Ulkem Company PtteM Kart)
- [CVE-2023-23638](https://cve.now/CVE-2023-23638.md): Apache Dubbo Deserialization Vulnerability Gadgets Bypass (CVSS 5.0, Apache Software Foundation Apache Dubbo · org.apache.dubbo:…)
- [CVE-2023-0090](https://cve.now/CVE-2023-0090.md): Proofpoint Enterprise Protection webservices unauthenticated RCE (CVSS 9.8, proofpoint enterprise\_protection)
- [CVE-2023-0089](https://cve.now/CVE-2023-0089.md): Proofpoint Enterprise Protection webutils authenticated RCE (CVSS 8.8, proofpoint enterprise\_protection)
- [CVE-2018-25081](https://cve.now/CVE-2018-25081.md): Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element. (CVSS 7.5)
- [CVE-2021-33351](https://cve.now/CVE-2021-33351.md): Cross Site Scripting Vulnerability in Wyomind Help Desk Magento 2 extension v.1.3.6 and before and fixed in v.1.3.7 allows attackers to esca (CVSS 9.0)
- [CVE-2021-33352](https://cve.now/CVE-2021-33352.md): An issue in Wyomind Help Desk Magento 2 extension v.1.3.6 and before fixed in v.1.3.7 allows attacker to execute arbitrary code via a phar f (CVSS 9.8)
- [CVE-2021-33353](https://cve.now/CVE-2021-33353.md): Directory Traversal vulnerability in Wyomind Help Desk Magento 2 extension v.1.3.6 and before fixed in v.1.3.7 allows attacker to execute ar (CVSS 9.8)
- [CVE-2021-33639](https://cve.now/CVE-2021-33639.md): REMAP cmd of SVM driver can be used to remap read only memory as read-write, then cause read only memory/file modified. (CVSS 7.5, kernel)
- [CVE-2022-4007](https://cve.now/CVE-2022-4007.md): A issue has been discovered in GitLab CE/EE affecting all versions from 15.3 prior to 15.7.8, version 15.8 prior to 15.8.4, and version 15.9 (CVSS 5.4, GitLab)
- [CVE-2022-4315](https://cve.now/CVE-2022-4315.md): An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 2.0 before 3.0.55, which sends custom request head (CVSS 5.0, GitLab)
- [CVE-2022-46394](https://cve.now/CVE-2022-46394.md): An issue was discovered in the Arm Mali GPU Kernel Driver. (CVSS 8.8)
- [CVE-2023-0030](https://cve.now/CVE-2023-0030.md): A use-after-free flaw was found in the Linux kernel’s nouveau driver in how a user triggers a memory overflow that causes the nvkm\_vma\_tail (CVSS 7.8, kernel)
- [CVE-2023-1269](https://cve.now/CVE-2023-1269.md): Use of Hard-coded Credentials in alextselegidis/easyappointments (CVSS 6.5, alextselegidis/easyappointments)
- [CVE-2023-1270](https://cve.now/CVE-2023-1270.md): Cross-site Scripting in btcpayserver/btcpayserver (CVSS 5.1, btcpayserver/btcpayserver)
- [CVE-2023-1283](https://cve.now/CVE-2023-1283.md): Code Injection in builderio/qwik (CVSS 10.0, builderio/qwik · @builder.io/qwik)
- [CVE-2023-22889](https://cve.now/CVE-2023-22889.md): SmartBear Zephyr Enterprise through 7.15.0 mishandles user-defined input during report generation. (CVSS 9.8)
- [CVE-2023-22890](https://cve.now/CVE-2023-22890.md): SmartBear Zephyr Enterprise through 7.15.0 allows unauthenticated users to upload large files, which could exhaust the local drive space, ca (CVSS 7.5)
- [CVE-2023-22891](https://cve.now/CVE-2023-22891.md): There exists a privilege escalation vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by authorized users (CVSS 8.1)
- [CVE-2023-22892](https://cve.now/CVE-2023-22892.md): There exists an information disclosure vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by unauthenticate (CVSS 7.5)
- [CVE-2023-24282](https://cve.now/CVE-2023-24282.md): An arbitrary file upload vulnerability in Poly Trio 8800 7.2.2.1094 allows attackers to execute arbitrary code via a crafted ringtone file. (CVSS 5.4)
- [CVE-2023-24657](https://cve.now/CVE-2023-24657.md): phpipam v1.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the closeClass parameter at /subnet-masks/po (CVSS 6.1)
- [CVE-2023-24773](https://cve.now/CVE-2023-24773.md): Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/list. (CVSS 9.8, funadmin/funadmin)
- [CVE-2023-24777](https://cve.now/CVE-2023-24777.md): Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/list. (CVSS 9.8, funadmin/funadmin)
- [CVE-2023-24782](https://cve.now/CVE-2023-24782.md): Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/edit. (CVSS 9.8, funadmin/funadmin)
- [CVE-2023-25395](https://cve.now/CVE-2023-25395.md): TOTOlink A7100RU V7.4cu.2313\_B20191024 router was discovered to contain a command injection vulnerability via the ou parameter at /setting/d (no CVSS)
- [CVE-2023-26261](https://cve.now/CVE-2023-26261.md): In UBIKA WAAP Gateway/Cloud through 6.10, a blind XPath injection leads to an authentication bypass by stealing the session of another conne (CVSS 9.8)
- [CVE-2023-26922](https://cve.now/CVE-2023-26922.md): SQL injection vulnerability found in Varisicte matrix-gui v.2 allows a remote attacker to execute arbitrary code via the shell\_exect paramet (CVSS 9.8)
- [CVE-2023-26950](https://cve.now/CVE-2023-26950.md): onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Title parameter under the Adding Cate (CVSS 5.4)
- [CVE-2023-26952](https://cve.now/CVE-2023-26952.md): onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Menu module. (CVSS 5.4)
- [CVE-2023-26956](https://cve.now/CVE-2023-26956.md): onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/curd/code. (CVSS 7.5)
- [CVE-2023-27088](https://cve.now/CVE-2023-27088.md): feiqu-opensource Background Vertical authorization vulnerability exists in IndexController.java. (CVSS 8.8)
- [CVE-2023-27477](https://cve.now/CVE-2023-27477.md): wasmtime is a fast and secure runtime for WebAssembly. (CVSS 3.1, bytecodealliance wasmtime · wasmtime +1)
- [CVE-2023-27482](https://cve.now/CVE-2023-27482.md): homeassistant is an open source home automation tool. (CVSS 10.0, home-assistant core · home-assistant supervisor)
- [CVE-2023-27974](https://cve.now/CVE-2023-27974.md): Bitwarden through 2023.2.1 offers password auto-fill when the second-level domain matches, e.g., a password stored for an example.com hostin (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-03-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.